Clickjacking in Flask (Python)

Clickjacking is a client-side injection attack where an attacker tricks a user into interacting with a hidden or disguised UI element inside an iframe. In a Flask application written in Python, this typically occurs when a page is served without explicit protections against being embedded, allowing malicious sites to overlay transparent elements on top of your forms and buttons.

Flask does not set anti-clickjacking headers by default. If your Python views render sensitive actions (such as changing email, updating a profile, or performing a payment) without enforcing frame-embedding rules, an attacker can craft a page that loads your route in an invisible <iframe> and position controls under the cursor. Because the request is authenticated via session cookies, the action executes in the user’s context, leading to unauthorized operations.

The risk is compounded when Content Security Policy (CSP) frame-ancestors is absent or too permissive (e.g., frame-ancestors *). In Python/Flask, this often results from ad hoc header additions or middleware that does not apply consistently across all responses. Development configurations may also disable security headers, inadvertently exposing production-like behavior during testing. Routes that render forms with state-changing POST methods are especially vulnerable if they lack explicit X-Frame-Options or CSP frame-ancestors directives.

Consider a Flask view that performs a money transfer without enforcing framing rules:

from flask import Flask, request, session, render_template_string

app = Flask(__name__)
app.secret_key = 'dev-secret-key'

@app.route('/transfer')
def transfer_get():
    return render_template_string('''
      <form method="POST" action="/transfer">
        <input type="number" name="amount" placeholder="Amount" />
        <button type="submit">Transfer</button>
      </form>
    ''')

@app.route('/transfer', methods=['POST'])
def transfer_post():
    amount = request.form.get('amount')
    # If rendered without anti-clickjacking headers, this can be triggered via iframe
    return f'Transferring {amount}'

Without protective headers, an attacker’s page can embed this route and overlay a transparent button on ‘Transfer’ to initiate unauthorized transactions. The Flask app remains unaware because the request appears legitimate, originating from a browser with valid cookies.

Because middleBrick scans unauthenticated attack surfaces and tests input validation and security headers, it can detect missing anti-clickjacking controls in Flask apps. Its findings include severity ratings and remediation guidance mapped to frameworks such as OWASP API Top 10 and CSP best practices, helping you identify and fix these issues before attackers do.

To defend against clickjacking in Flask applications written in Python, enforce frame-embedding rules using either the X-Frame-Options header or a strict Content Security Policy frame-ancestors. The recommended approach is to apply these protections globally via a before-request hook so that every response includes the appropriate headers, ensuring consistency across all views.

Option 1: X-Frame-Options — Simple and widely supported. Set to DENY (no framing) or SAMEORIGIN (allow same-origin frames only).

from flask import Flask, request

app = Flask(__name__)

@app.before_request
def set_x_frame_options():
    # Apply to all responses from this Flask app
    request.response_x_frame_options = 'DENY'

Option 2: Content Security Policy frame-ancestors — More flexible and future-proof. Use a strict policy that limits who can embed your pages.

from flask import Flask, request

app = Flask(__name__)

@app.before_request
def set_csp_frame_ancestors():
    # Prevent any site from framing this app
    request.response_headers['Content-Security-Policy'] = "frame-ancestors 'none'"

If you need to allow specific trusted origins, list them explicitly instead of using wildcards:

@app.before_request
def set_csp_frame_ancestors():
    request.response_headers['Content-Security-Policy'] = "frame-ancestors 'self' https://trusted.example.com"

For apps using Flask-Talisman, you can enforce CSP frame-ancestors declaratively:

from flask import Flask
from flask_talisman import Talisman

app = Flask(__name__)
talisman = Talisman(
    app,
    content_security_policy={
        'frame-ancestors': ["'self'"]
    },
    force_https=True
)

Combine these headers with secure development practices: validate and sanitize all inputs, use SameSite cookies for session management, and avoid permissive CSP values like frame-ancestors *. Because middleBrick includes checks for CSP frame-ancestors and X-Frame-Options, running a scan against your Flask endpoint can confirm whether these defenses are present and correctly configured, with prioritized findings and remediation guidance included in the report.

Use the middleBrick CLI to validate your fixes from the terminal:

middlebrick scan https://your-flask-api.example.com/transfer

In CI/CD, the GitHub Action can enforce a minimum security score and fail builds if clickjacking-related headers are missing. The MCP Server lets you run the same checks directly from your AI coding assistant inside the IDE, streamlining secure coding workflows for Python/Flask APIs.